filebeat: disable cloud_metadata processor by default

CHANGELOG.md

@@ -11,6 +11,7 @@ The **patch** part changes incrementally at each release.
 ## [Unreleased]
 
 ### Added
+* filebeat: disable cloud_metadata processor by default
 * redis: add variable for configure unixsocketperm
 
 ### Changed

filebeat/defaults/main.yml

@@ -2,3 +2,5 @@
 elastic_stack_version: "6.x"
 
 filebeat_logstash_plugin: False
+
+filebeat_processors_cloud_metadata: False

filebeat/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+
+- name: restart filebeat
+  systemd:
+    name: filebeat
+    state: restarted

filebeat/tasks/main.yml

@@ -64,3 +64,19 @@
   - filebeat_logstash_plugin
   - logstash_plugin.stat.exists
   - not logstash_plugin_installed | success
+
+- name: cloud_metadata processor is disabled
+  replace:
+    dest: /etc/filebeat/filebeat.yml
+    regexp: '^(\s+)(- add_cloud_metadata:)'
+    replace: '\1# \2'
+  notify: restart filebeat
+  when: not filebeat_processors_cloud_metadata
+
+- name: cloud_metadata processor is disabled
+  lineinfile:
+    dest: /etc/filebeat/filebeat.yml
+    line: "  - add_cloud_metadata: ~"
+    insert_after: '^processors:'
+  notify: restart filebeat
+  when: filebeat_processors_cloud_metadata